BX

AI with a seatbelt·bxsandbox.app

BX is a macOS app that runs AI tools such as Claude, Claude Code, Cursor, VS Code and command-line coding agents inside a sandbox built into macOS. A launcher lets the user choose which folders an app may see, so the app can read and write only the project it was given and not credentials, mail, messages, or the rest of the files on the Mac. It works through the operating system's own sandbox mechanism rather than a virtual machine or container, so the app keeps its normal settings, logins and extensions.

What it's for

Sandbox AI apps like Claude, Claude Code, Cursor, VS Code so they can only see chosen project foldersKeep credentials, SSH keys, shell history, mail and password managers out of reach of AI toolsContain risk from package installers and build tools (pnpm install, pip install, cargo build, make, Gradle)Separate client data in contract work so one client's material stays out of reach while working for anotherSafely inspect cloned/unfamiliar GitHub repositories before trusting their scripts and config filesRun MCP servers and command-line coding agents with restricted file accessControl network access of a sandboxed session (full, local-only, or none)

Features 16

.bxignore rule files in gitignore syntax, usable globally, per launcher or per project
Command line tools: bx run, bx dry, bx list, bx doctor
Developer tools toggle controlling access to toolchains, .gitconfig and Homebrew directories
Dock integration: per-launcher icon with BX seatbelt mark, launchers grouped as a stack
Homebrew installation via brew install --cask
Launcher setup: pick an app/command and one or more folders
Menu bar indicator showing protection status and warnings for unprotected runs
Multi-language interface: English, German, French, Spanish, Italian
Network access control per session: Full access, This Mac only, or No network
Open files/links in other apps toggle (opens outside the sandbox)
Per-launcher short alias usable in the terminal
Protection tab shows a tree of what is read-write, read-only, or blocked
Recognizes common apps (VS Code and variants, JetBrains IDEs, Claude Desktop, ChatGPT, Xcode) and CLI agents automatically
Records denied accesses to show what a tool was turned away from
Right-click rules to grant Read and write / Read only / No access per launcher or for all launchers
Runs apps inside the native macOS sandbox (no VM or container)

At a glance

free tierfree trial

TypeDesktop app

DeploymentInstalled (local)

PlatformsmacOS

LanguagesEnglish, German, French, Spanish, Italian

Fordevelopers, people who use AI coding tools, contract/freelance developers working for multiple clients, non-developers who use AI apps that can read files

CompanyDirk Holtwick

Integrations

ChatGPTCursor CLIPaddle.comFactory DroidCodexiTerm2AmpTerminalJetBrains IDEsAiderGhosttyCrushGooseClaude CodeCursorQwen CodeClaudeVS CodeGemini CLIGitHub Copilot CLIXcodeopencodeHomebrew

Complianceself-reported

GDPR

Resources

Changelog

Pricing

BX is sold only as a one-time purchase (no subscription) at $29.99 (also listed as €29.99). Protection works fully in the free/trial version for three days before showing a reminder to pay; the app continues to protect afterward. Not sold through the Mac App Store because an app applying a sandbox profile cannot itself run inside one.

BX LicenseQuote

Purchase processed via Paddle.com; price shown includes VAT and is adjusted for the buyer's country at checkout. Also listed at €29.99 for EUR pricing.

One-time purchase, license does not expire, no recurring charge; three-day free trial beforehand

BX